)]}' { "log": [ { "commit": "aa18f6fcc491d131e2b67135622e3c089bd5d0b4", "tree": "40086c66ca378f8d1334fa8f2ad84243eafedc31", "parents": [ "6ff9603dec2399dbe2fe9e5fe87c11fda054c668" ], "author": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Wed Jun 15 10:21:48 2011 -0700" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sat Oct 17 16:13:18 2015 -0700" }, "message": "proc: Usable inode numbers for the namespace file descriptors.\n\nAssign a unique proc inode to each namespace, and use that\ninode number to ensure we only allocate at most one proc\ninode for every namespace in proc.\n\nA single proc inode per namespace allows userspace to test\nto see if two processes are in the same namespace.\n\nThis has been a long requested feature and only blocked because\na naive implementation would put the id in a global space and\nwould ultimately require having a namespace for the names of\nnamespaces, making migration and certain virtualization tricks\nimpossible.\n\nWe still don\u0027t have per superblock inode numbers for proc, which\nappears necessary for application unaware checkpoint/restart and\nmigrations (if the application is using namespace file descriptors)\nbut that is now allowd by the design if it becomes important.\n\nI have preallocated the ipc and uts initial proc inode numbers so\ntheir structures can be statically initialized.\n\nSigned-off-by: Eric W. Biederman \u003cebiederm@xmission.com\u003e\n(cherry picked from commit 98f842e675f96ffac96e6c50315790912b2812be)\n" }, { "commit": "5a27d6987454a169a4f3362e1a14c77ad1aca193", "tree": "1e77ce7332436cc78d9863a0c2425aab0879c895", "parents": [ "d19157519c9d76828df39cae34cc0d824356f7db" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Tue Nov 12 15:11:47 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Apr 14 06:44:16 2014 -0700" }, "message": "ipc, msg: fix message length check for negative values\n\ncommit 4e9b45a19241354daec281d7a785739829b52359 upstream.\n\nOn 64 bit systems the test for negative message sizes is bogus as the\nsize, which may be positive when evaluated as a long, will get truncated\nto an int when passed to load_msg(). So a long might very well contain a\npositive value but when truncated to an int it would become negative.\n\nThat in combination with a small negative value of msg_ctlmax (which will\nbe promoted to an unsigned type for the comparison against msgsz, making\nit a big positive value and therefore make it pass the check) will lead to\ntwo problems: 1/ The kmalloc() call in alloc_msg() will allocate a too\nsmall buffer as the addition of alen is effectively a subtraction. 2/ The\ncopy_from_user() call in load_msg() will first overflow the buffer with\nuserland data and then, when the userland access generates an access\nviolation, the fixup handler copy_user_handle_tail() will try to fill the\nremainder with zeros -- roughly 4GB. That almost instantly results in a\nsystem crash or reset.\n\n ,-[ Reproducer (needs to be run as root) ]--\n | #include \u003csys/stat.h\u003e\n | #include \u003csys/msg.h\u003e\n | #include \u003cunistd.h\u003e\n | #include \u003cfcntl.h\u003e\n |\n | int main(void) {\n | long msg \u003d 1;\n | int fd;\n |\n | fd \u003d open(\"/proc/sys/kernel/msgmax\", O_WRONLY);\n | write(fd, \"-1\", 2);\n | close(fd);\n |\n | msgsnd(0, \u0026msg, 0xfffffff0, IPC_NOWAIT);\n |\n | return 0;\n | }\n \u0027---\n\nFix the issue by preventing msgsz from getting truncated by consistently\nusing size_t for the message length. This way the size checks in\ndo_msgsnd() could still be passed with a negative value for msg_ctlmax but\nwe would fail on the buffer allocation in that case and error out.\n\nAlso change the type of m_ts from int to size_t to avoid similar nastiness\nin other code paths -- it is used in similar constructs, i.e. signed vs.\nunsigned checks. It should never become negative under normal\ncircumstances, though.\n\nSetting msg_ctlmax to a negative value is an odd configuration and should\nbe prevented. As that might break existing userland, it will be handled\nin a separate commit so it could easily be reverted and reworked without\nreintroducing the above described bug.\n\nHardening mechanisms for user copy operations would have catched that bug\nearly -- e.g. checking slab object sizes on user copy operations as the\nusercopy feature of the PaX patch does. Or, for that matter, detect the\nlong vs. int sign change due to truncation, as the size overflow plugin\nof the very same patch does.\n\n[akpm@linux-foundation.org: fix i386 min() warnings]\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Pax Team \u003cpageexec@freemail.hu\u003e\nCc: Davidlohr Bueso \u003cdavidlohr@hp.com\u003e\nCc: Brad Spengler \u003cspender@grsecurity.net\u003e\nCc: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n[bwh: Backported to 3.2:\n - Adjust context\n - Drop changes to alloc_msg() and copy_msg(), which don\u0027t exist]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Qiang Huang \u003ch.huangqiang@huawei.com\u003e\nCc: Li Zefan \u003clizefan@huawei.com\u003e\nCc: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "4040153087478993cbf0809f444400a3c808074c", "tree": "2dc7af85b0cf930f1656553bd38410b8c16601a6", "parents": [ "191c542442fdf53cc3c496c00be13367fd9cd42d" ], "author": { "name": "Al Viro", "email": "viro@ftp.linux.org.uk", "time": "Mon Feb 13 03:58:52 2012 +0000" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Tue Feb 14 10:45:42 2012 +1100" }, "message": "security: trim security.h\n\nTrim security.h\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "6f686574cccc2ef66fb38e41f19cedd81e7b4504", "tree": "3ca07460f6dfc6f083ecdb8dbb96e2f525d97696", "parents": [ "905ad269c55fc62bee3da29f7b1d1efeba8aa1e1" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Fri Dec 09 00:38:50 2011 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Fri Dec 09 00:40:21 2011 -0500" }, "message": "... and the same kind of leak for mqueue\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "b515498f5bb5f38fc0e390b4ff7d00b6077de127", "tree": "b76dfc56415adee9aec5d8619124059ed3ab02a5", "parents": [ "fc832ad3645f0507f24d11752544525a50a83c71" ], "author": { "name": "Serge E. Hallyn", "email": "serge@hallyn.com", "time": "Wed Mar 23 16:43:23 2011 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Mar 23 19:47:07 2011 -0700" }, "message": "userns: add a user namespace owner of ipc ns\n\nChangelog:\n\tFeb 15: Don\u0027t set new ipc-\u003euser_ns if we didn\u0027t create a new\n\t\tipc_ns.\n\tFeb 23: Move extern declaration to ipc_namespace.h, and group\n\t\tfwd declarations at top.\n\nSigned-off-by: Serge E. Hallyn \u003cserge.hallyn@canonical.com\u003e\nAcked-by: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nAcked-by: Daniel Lezcano \u003cdaniel.lezcano@free.fr\u003e\nAcked-by: David Howells \u003cdhowells@redhat.com\u003e\nCc: James Morris \u003cjmorris@namei.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "7eafd7c74c3f2e67c27621b987b28397110d643f", "tree": "b4621aab78b6303f20386096c230b993044a4db7", "parents": [ "614b84cf4e4a920d2af32b8f147ea1e3b8c27ea6" ], "author": { "name": "Serge E. Hallyn", "email": "serue@us.ibm.com", "time": "Mon Apr 06 19:01:10 2009 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 07 08:31:09 2009 -0700" }, "message": "namespaces: ipc namespaces: implement support for posix msqueues\n\nImplement multiple mounts of the mqueue file system, and link it to usage\nof CLONE_NEWIPC.\n\nEach ipc ns has a corresponding mqueuefs superblock. When a user does\nclone(CLONE_NEWIPC) or unshare(CLONE_NEWIPC), the unshare will cause an\ninternal mount of a new mqueuefs sb linked to the new ipc ns.\n\nWhen a user does \u0027mount -t mqueue mqueue /dev/mqueue\u0027, he mounts the\nmqueuefs superblock.\n\nPosix message queues can be worked with both through the mq_* system calls\n(see mq_overview(7)), and through the VFS through the mqueue mount. Any\nusage of mq_open() and friends will work with the acting task\u0027s ipc\nnamespace. Any actions through the VFS will work with the mqueuefs in\nwhich the file was created. So if a user doesn\u0027t remount mqueuefs after\nunshare(CLONE_NEWIPC), mq_open(\"/ab\") will not be reflected in \"ls\n/dev/mqueue\".\n\nIf task a mounts mqueue for ipc_ns:1, then clones task b with a new ipcns,\nipcns:2, and then task a is the last task in ipc_ns:1 to exit, then (1)\nipc_ns:1 will be freed, (2) it\u0027s superblock will live on until task b\numounts the corresponding mqueuefs, and vfs actions will continue to\nsucceed, but (3) sb-\u003es_fs_info will be NULL for the sb corresponding to\nthe deceased ipc_ns:1.\n\nTo make this happen, we must protect the ipc reference count when\n\na) a task exits and drops its ipcns-\u003ecount, since it might be dropping\n it to 0 and freeing the ipcns\n\nb) a task accesses the ipcns through its mqueuefs interface, since it\n bumps the ipcns refcount and might race with the last task in the ipcns\n exiting.\n\nSo the kref is changed to an atomic_t so we can use\natomic_dec_and_lock(\u0026ns-\u003ecount,mq_lock), and every access to the ipcns\nthrough ns \u003d mqueuefs_sb-\u003es_fs_info is protected by the same lock.\n\nSigned-off-by: Cedric Le Goater \u003cclg@fr.ibm.com\u003e\nSigned-off-by: Serge E. Hallyn \u003cserue@us.ibm.com\u003e\nCc: Alexey Dobriyan \u003cadobriyan@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "614b84cf4e4a920d2af32b8f147ea1e3b8c27ea6", "tree": "52478e38cd400042bd89f123c4101c95943ae492", "parents": [ "909e6d94795654040ed416ac69858d5d2ce66dd3" ], "author": { "name": "Serge E. Hallyn", "email": "serue@us.ibm.com", "time": "Mon Apr 06 19:01:08 2009 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 07 08:31:09 2009 -0700" }, "message": "namespaces: mqueue ns: move mqueue_mnt into struct ipc_namespace\n\nMove mqueue vfsmount plus a few tunables into the ipc_namespace struct.\nThe CONFIG_IPC_NS boolean and the ipc_namespace struct will serve both the\nposix message queue namespaces and the SYSV ipc namespaces.\n\nThe sysctl code will be fixed separately in patch 3. After just this\npatch, making a change to posix mqueue tunables always changes the values\nin the initial ipc namespace.\n\nSigned-off-by: Cedric Le Goater \u003cclg@fr.ibm.com\u003e\nSigned-off-by: Serge E. Hallyn \u003cserue@us.ibm.com\u003e\nCc: Alexey Dobriyan \u003cadobriyan@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "5cbded585d129d0226cb48ac4202b253c781be26", "tree": "fb24edc194a57ee81a3bf8a4dd8a95030dd0ad22", "parents": [ "0743b86800cf1dfbf96df4a438938127bbe4476c" ], "author": { "name": "Robert P. J. Day", "email": "rpjday@mindspring.com", "time": "Wed Dec 13 00:35:56 2006 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.osdl.org", "time": "Wed Dec 13 09:05:58 2006 -0800" }, "message": "[PATCH] getting rid of all casts of k[cmz]alloc() calls\n\nRun this:\n\n\t#!/bin/sh\n\tfor f in $(grep -Erl \"\\([^\\)]*\\) *k[cmz]alloc\" *) ; do\n\t echo \"De-casting $f...\"\n\t perl -pi -e \"s/ ?\u003d ?\\([^\\)]*\\) *(k[cmz]alloc) *\\(/ \u003d \\1\\(/\" $f\n\tdone\n\nAnd then go through and reinstate those cases where code is casting pointers\nto non-pointers.\n\nAnd then drop a few hunks which conflicted with outstanding work.\n\nCc: Russell King \u003crmk@arm.linux.org.uk\u003e, Ian Molton \u003cspyro@f2s.com\u003e\nCc: Mikael Starvik \u003cstarvik@axis.com\u003e\nCc: Yoshinori Sato \u003cysato@users.sourceforge.jp\u003e\nCc: Roman Zippel \u003czippel@linux-m68k.org\u003e\nCc: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\nCc: Ralf Baechle \u003cralf@linux-mips.org\u003e\nCc: Paul Mackerras \u003cpaulus@samba.org\u003e\nCc: Kyle McMartin \u003ckyle@mcmartin.ca\u003e\nCc: Benjamin Herrenschmidt \u003cbenh@kernel.crashing.org\u003e\nCc: Martin Schwidefsky \u003cschwidefsky@de.ibm.com\u003e\nCc: \"David S. Miller\" \u003cdavem@davemloft.net\u003e\nCc: Jeff Dike \u003cjdike@addtoit.com\u003e\nCc: Greg KH \u003cgreg@kroah.com\u003e\nCc: Jens Axboe \u003cjens.axboe@oracle.com\u003e\nCc: Paul Fulghum \u003cpaulkf@microgate.com\u003e\nCc: Alan Cox \u003calan@lxorguk.ukuu.org.uk\u003e\nCc: Karsten Keil \u003ckkeil@suse.de\u003e\nCc: Mauro Carvalho Chehab \u003cmchehab@infradead.org\u003e\nCc: Jeff Garzik \u003cjeff@garzik.org\u003e\nCc: James Bottomley \u003cJames.Bottomley@steeleye.com\u003e\nCc: Ian Kent \u003craven@themaw.net\u003e\nCc: Steven French \u003csfrench@us.ibm.com\u003e\nCc: David Woodhouse \u003cdwmw2@infradead.org\u003e\nCc: Neil Brown \u003cneilb@cse.unsw.edu.au\u003e\nCc: Jaroslav Kysela \u003cperex@suse.cz\u003e\nCc: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "f30c2269544bffc7bf1b0d7c0abe5be1be83b8cb", "tree": "2f6140d8a555af6a133690ed6b42599e78a43c54", "parents": [ "670e9f34ee3c7e052514c85014d2fdd99b672cdc" ], "author": { "name": "Uwe Zeisberger", "email": "Uwe_Zeisberger@digi.com", "time": "Tue Oct 03 23:01:26 2006 +0200" }, "committer": { "name": "Adrian Bunk", "email": "bunk@stusta.de", "time": "Tue Oct 03 23:01:26 2006 +0200" }, "message": "fix file specification in comments\n\nMany files include the filename at the beginning, serveral used a wrong one.\n\nSigned-off-by: Uwe Zeisberger \u003cUwe_Zeisberger@digi.com\u003e\nSigned-off-by: Adrian Bunk \u003cbunk@stusta.de\u003e\n" }, { "commit": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "tree": "0bba044c4ce775e45a88a51686b5d9f90697ea9d", "parents": [], "author": { "name": "Linus Torvalds", "email": "torvalds@ppc970.osdl.org", "time": "Sat Apr 16 15:20:36 2005 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@ppc970.osdl.org", "time": "Sat Apr 16 15:20:36 2005 -0700" }, "message": "Linux-2.6.12-rc2\n\nInitial git repository build. I\u0027m not bothering with the full history,\neven though we have it. We can create a separate \"historical\" git\narchive of that later if we want to, and in the meantime it\u0027s about\n3.2GB when imported into git - space that would just make the early\ngit days unnecessarily complicated, when we don\u0027t have a lot of good\ninfrastructure for it.\n\nLet it rip!\n" } ] }